lkml.org 
[lkml]   [2012]   [May]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH RFC v3 3/3] pinctrl: add pinctrl gpio binding support
    On Fri, May 25, 2012 at 12:59:47PM +0800, Stephen Warren wrote:
    > On 05/24/2012 09:22 PM, Dong Aisheng wrote:
    > > On Thu, May 24, 2012 at 11:22:13PM +0800, Stephen Warren wrote:
    > ...
    > >> The problem is this:
    > >>
    > >> Thread 1: Call of_node_to_gpiochip(), returns a gpio_chip.
    > >> Thread 2: Unregisters the same gpio_chip that was returned above.
    > >> Thread 1: Accesses the now unregistered (and possibly free'd) gpio_chip
    > >> -> at best, bad data, at worst, OOPS.
    > >>
    > > Correct. We did have this issue.
    > > Thanks for clarify.
    > >
    > >> In order to prevent this, of_node_to_gpiochip() should take measures to
    > >> prevent another thread from unregistering the gpio_chip until thread 1
    > >> has completed its step above.
    > >>
    > >> The existing of_get_named_gpio_flags() is safe from this, since
    > >> gpiochip_find() acquires the GPIO lock, and all accesses to the fouond
    > >> gpio chip occur with that lock held, inside the match function. Perhaps
    > >> a similar approach could be used here.
    > >
    > > Why it looks to me of_get_named_gpio_flags has the same issue and also not safe?
    > > For of_node_to_gpiochip itself called in of_get_named_gpio_flags, it's safe.
    >
    > Uggh. Yes, I meant that of_node_to_gpiochip() itself doesn't have this
    > issue, but you're right, it looks like of_get_named_gpio_flags() does.
    >
    > > But after that, i'm suspecting it has the same issue as you described above, right?
    > >
    > > For example:
    > > int of_get_named_gpio_flags(struct device_node *np, const char *propname,
    > > int index, enum of_gpio_flags *flags)
    > > {
    > > ...
    > > gc = of_node_to_gpiochip(gpiospec.np);
    > > if (!gc) {
    > > pr_debug("%s: gpio controller %s isn't registered\n",
    > > np->full_name, gpiospec.np->full_name);
    > > ret = -ENODEV;
    > > goto err1;
    > > }
    > >
    > > ===> the gc may be unregistered here by another thread and
    > > even already have been freed, right?
    > >
    > > ret = gc->of_xlate(gc, &gpiospec, flags);
    > > ...
    > > }
    > >
    > > Maybe we need get the lock in of_node_to_gpiochip and release it by calling
    > > of_gpio_put(..) after using?
    >
    > Yes, something like that; it should take the module lock, not the gpio lock.
    >
    Okay, i will try to add it.

    Regards
    Dong Aisheng



    \
     
     \ /
      Last update: 2012-05-25 07:41    [W:0.030 / U:0.196 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site